Privacy

Who we are

FreeWillWave ("the Wave") is operated by MyNewMe LLC, a limited liability company registered in the United States — 412 W 7th Street, Suite 214, Clovis 88101, New Mexico, USA. This policy explains what personal data we collect when you use freewillwave.com, why, and the choices you have. It forms an integral part of our Terms.

What we collect

We collect the minimum needed to run the Wave:
• your email address — your sign-in identity, never shown publicly;
• the country and primary language on your profile — the country starts from a suggestion, see below;
• the public profile fields you fill in (display name, bio, links) and your interface language;
• the messages you send on the Wave — energies, direct messages and feedback — see below;
• your notification preferences;
• which member is at the origin of your arrival, so the Wave's relay stays consistent;
• a record of any voluntary contributions you make.

Your country and your IP address

When you arrive, we suggest a country from the one your connection appears to come from — so the field is already filled in and you rarely have to touch it. It is only ever a suggestion: you can change it when you sign up, and at any time afterwards in your settings. If you sign in with Google or Facebook, we cannot ask you, so the suggestion is kept as-is until you change it.

That is the whole of it. We do not store your IP address for this, we run no geolocation service on you, and your country is never used to decide what you see — it counts towards the public per-country totals, nothing else.

Cookies

We use only essential cookies: your session (authentication), your language preference, your display theme, and — after a member's invitation link has been opened — an invitation cookie kept for up to 30 days so that a sign-up is credited to the member who invited you. We use no third-party tracking cookies and no advertising cookies, with the single advertising-measurement exception described below.

Invitation links

When you open an invitation link, the visit is recorded only in a hashed form that cannot identify you — we keep no readable address and build no browsing profile. If you then join, the invitation cookie tells us which member's link brought you: that member is credited, and your profile takes its place in the referral chain.

Messages between members

Energies, direct messages and feedback are stored so they can be delivered, and are visible to the people they are addressed to — feedback is read by us. We do not scan your messages for advertising and we never sell them. Moderation happens only when a message is reported or clearly breaks the rules set out in our Terms.

The help assistant

When you use the site's help assistant, your question and the conversation around it are sent to DeepSeek, the AI provider that generates the answer — only when you use the assistant, and nothing more. Please do not put personal details into your questions; they are not needed for an answer.

Emails and notifications

We send transactional email through Resend: sign-in codes, receipts, and the notifications you have enabled — including the weekly letter. You choose what you receive in your notification settings, and every non-essential email can be turned off there.

Payments

Payments are processed by Stripe. Once Stripe Managed Payments is enabled, Stripe acts as the merchant of record for purchases. We never receive or store your card details.

Service providers

We rely on a small set of processors, each processing only the data needed to provide its service:
• Supabase (United States) — database, authentication and storage;
• Vercel (United States) — website hosting;
• Stripe (United States) — payment processing;
• Resend (United States) — transactional email;
• Umami (self-hosted) — cookieless, anonymous visit counting;
• DeepSeek (China) — generates the help assistant's answers, only when you use the assistant.
Each provider is contractually required to protect your data and to use it only to provide its service to us.

Measurement and advertising

We count visits with Umami, a privacy-first tool we host ourselves. It is cookieless: it sets no cookies, stores no IP address, and collects no personal data and no cross-site identifier. Nothing is left on your device.

When we advertise, the ad platform's measurement tag is loaded here so the platform can learn which visits led to a sign-up — without that feedback it cannot tell who is interested, and shows the ad at random. One such tag is active today: the X (Twitter) pixel, for our advertising on X. It loads a script from static.ads-twitter.com and sends measurement events to X. Unlike Umami, it sets cookies, and X may link a visit to an X account.

What it sends is the bare signal that a sign-up happened — never your email, your name, or your Free Human number. Our advertising currently runs in the United States only. A tracker blocker prevents the pixel from loading, and the Wave works exactly the same without it.

Public versus private

Your public presence in the Wave — display name, Free Human number, declared country, primary language, badges and activity counts — is public by design, together with the aggregate counts per country and per language. Your email address, your messages and your sign-in activity are never public.

How we protect your data

Data travels encrypted (HTTPS/TLS). Access to the database is restricted row by row (Row Level Security), writes are validated, and we run regular security audits of the code and infrastructure. Payment card details never touch our servers.

Retention, deletion and your rights

While your Free Human account is active, we keep your data for as long as the account exists. You may request access to, correction of, or deletion of your personal data at any time by writing to us (see below).

What happens when you delete your account

When you delete your account:
• your sign-in account and the active link between your login and your profile are deleted;
• your direct contact and presentation information (display name, bio, links, declared country, email, notifications and preferences) is erased or neutralised;
• your permanent Free Human number remains;
• the minimum structural position needed to preserve the Wave — your place in the referral chain — may remain in pseudonymised form;
• this retained node is no longer used to contact you or to publicly identify you;
• structural and historical aggregate results may remain;
• financial and accounting records may remain where the law requires it;
• creating a new account later does not automatically reclaim your previous Free Human number or node;
• ordinary deletion is irreversible.

This retained structural node is pseudonymised personal data, not anonymous data: it no longer carries your name or contact details, but it remains tied to a permanent identifier. Only aggregate statistics that cannot reasonably identify a person are described as anonymous.

Why we keep the structural node

We retain the pseudonymised structural node on the basis of our legitimate interests (GDPR Article 6(1)(f)): to preserve the integrity and historical accuracy of the Wave, to keep the referral chain consistent, to keep Free Human numbers consistent, to prevent manipulation or duplicated identities, and to preserve aggregate results already generated. We do not rely on consent as the principal basis for this permanent structural retention. Financial and accounting records are kept to comply with our legal obligations (GDPR Article 6(1)(c)).

How long we keep things

• your sign-in account and the active login–profile link: deleted when deletion completes;
• your direct profile, presentation and contact information: erased or neutralised during deletion;
• ordinary notification data and preferences: deleted;
• restricted security and deletion-audit records: kept for a limited, documented security period;
• payment and accounting records: kept for the period required by applicable law;
• the pseudonymised structural node: kept while FreeWillWave actively operates and the structural purpose remains necessary.
We review whether the structural node is still necessary at least once a year. When the project ends or the purpose disappears, this data is deleted, aggregated or further anonymised.

Where your data lives

Our servers and most of our service providers are located in the United States, so your information is processed there — a country whose data-protection laws differ from those of your country of residence. We take steps to keep your information protected wherever it is processed, including contractual safeguards with our providers. Questions asked to the help assistant are processed by DeepSeek only when you use it.

GDPR

For members in the European Union we apply the General Data Protection Regulation: we process data on the lawful bases of contract performance (running your account and the game), legitimate interests (security, and the structural node described above) and legal obligation (financial records); we collect only what is necessary and use it only for the purposes stated here.

Your rights

You may ask us to: access your data; correct it; delete it; restrict its processing; object to processing based on our legitimate interests (including the continued retention of your pseudonymised structural node); and receive a copy in a portable form where applicable. You may also ask us to review whether keeping your pseudonymised structural node is still necessary. You may lodge a complaint with your competent data-protection supervisory authority at any time.

Children

FreeWillWave is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has given us personal data, write to us and we will delete it.

Changes

We may update this policy as the Wave evolves. Material changes will be reflected here with a new "last updated" date.

Governing language

This document is provided in English. Where FreeWillWave offers a translation for convenience, the English version is authoritative and prevails in case of any discrepancy.

Translations are provided for information only and have no contractual value; only the English version is binding.